StudioFolio

Privacy Policy

Last updated: July 10, 2026

This policy explains what information StudioFolio ("StudioFolio", "we", "us") collects through the StudioFolio app and website (studiofolio.app) and the client gallery site (gallery.studiofolio.app), why we collect it, and how it's handled.

StudioFolio is a business tool for photographers. It helps a photographer (the "Studio") organize clients and projects, and share proofing galleries with their own clients (a Studio's "Clients") — using cloud storage the Studio already owns, such as Google Drive. StudioFolio does not host or copy a Studio's original photos; it stores metadata and mints temporary signed links to the Studio's own storage.

1. Information we collect

From a Studio (photographer account holder)

Data	Why we collect it
Email address and password	To create and secure your account (passwords are hashed by our authentication provider — we never see or store a plain-text password).
Cloud storage connection (e.g. Google Drive OAuth tokens)	To list your folders, import photo metadata, and generate temporary signed links so galleries load quickly. Tokens are encrypted at rest and only decrypted server-side when needed.
Client/CRM records you enter (names, emails, phone numbers, company, notes) and project details (titles, dates, stage, notes)	To provide the CRM and project-tracking features you use to run your business.
Gallery configuration (titles, access settings, share links, PINs)	To create and control access to the galleries you share.

From a Client (someone opening a shared gallery)

Data	Why we collect it
Gallery selections (favorites, ratings, album picks, rejects) and the marks ("edited") photographers assign to images	So the Studio can see, in real time, which photos a Client picked or rejected during proofing.
Comments left on photos, and an optional display name / email you provide	So a Studio and their Client can discuss specific photos inside the gallery.
The gallery PIN (if the Studio set one)	To verify you're an authorized viewer of a private gallery. PINs are not stored in plain text.

A Client's gallery activity is collected on behalf of, and controlled by, the Studio who created the gallery. If you're a Client and have questions about your data, we'd suggest contacting the Studio who shared the gallery with you directly, in addition to reaching us at the address below.

Automatically, from anyone using the site

• Standard technical logs from our hosting providers (IP address, browser/device type, timestamps, pages requested) — used only for security, abuse prevention, and diagnosing problems.

We do not use advertising trackers, and we do not sell personal information.

2. How we use information

• To operate the core features of StudioFolio: accounts, storage connections, galleries, proofing, comments, and the client/project CRM.
• To keep the service secure (detecting abuse, verifying gallery access).
• To communicate with you about your account (e.g. sign-in confirmations), when applicable.
• To fix bugs and improve reliability.

We do not use your data to train AI models, and we do not use it for advertising.

3. Where data is stored and how it's protected

• Application data (accounts, CRM records, gallery metadata, selections, comments) is stored in a managed Postgres database (Supabase), protected by row-level security so a Studio can only ever read or write their own data.
• Cloud storage OAuth tokens are encrypted before storage and only decrypted momentarily, server-side, to refresh a connection or mint a signed link.
• All traffic between your device and StudioFolio is encrypted in transit (HTTPS/TLS).
• Photo files themselves are never copied into StudioFolio's database — they stay in the Studio's own connected cloud storage (e.g. their Google Drive). StudioFolio generates short-lived signed URLs to display them.

4. Third parties we rely on

We use a small number of infrastructure providers to run StudioFolio. They process data on our behalf, under their own security and privacy commitments — we don't share your data with anyone else for their own purposes.

• Supabase — database, authentication, and backend functions (hosted in the EU).
• Cloudflare — hosts the web app and its standard request logs.
• Google Drive API — if a Studio connects Google Drive, to read the folders/files they explicitly grant access to.

5. Data retention and deletion

We keep account and project data for as long as your account is active. You can disconnect a cloud storage connection at any time from Settings, which revokes StudioFolio's access to it. To delete your account and associated data, contact us at the email below and we'll process the request promptly.

6. Children's privacy

StudioFolio is a business tool intended for photographers and their adult clients. It is not directed at children, and we do not knowingly collect personal information from children under 13.

7. Your rights

Depending on where you live, you may have rights to access, correct, or delete your personal information, or to object to certain processing. To exercise any of these rights, contact us at the email below.

8. Changes to this policy

We may update this policy as StudioFolio's features evolve. We'll update the "Last updated" date above when we do. Continued use of StudioFolio after a change means you accept the revised policy.